The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from the repository history that could influence the agent's actions during the PR creation process.
Ingestion points: The skill reads branch names and commit subjects via git log and git rev-parse commands as described in SKILL.md.
Boundary markers: Absent; there are no instructions or delimiters provided to prevent the agent from accidentally executing instructions embedded in git metadata.
Capability inventory: The skill possesses capabilities to push code (git push), move files (git mv), delete files (rm -f), and execute various platform CLIs (gh, glab, az, tea) and curl commands as defined in SKILL.md.
Sanitization: Absent; the skill does not explicitly describe validation or escaping for the strings derived from the repository before they are interpolated into PR fields or CLI commands.
[COMMAND_EXECUTION]: The skill constructs shell commands for GitHub, GitLab, and other CLIs using dynamic strings extracted from the git environment. This creates a surface for command injection if a malicious actor provides a specially crafted branch name or commit message containing shell metacharacters that are not escaped by the agent platform.

pr-create